Audit History
pennylane - 8 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v8 Latest | 2026εΉ΄7ζ5ζ₯ δΈε05:36 | 1 confirmed | 0 | No capability change |
| v7 | 2026εΉ΄7ζ5ζ₯ δΈε05:36 | 1 confirmed | 0 | Filesystem access |
| v6 | 2026εΉ΄6ζ30ζ₯ δΈε05:58 | No confirmed findings | 1 | External commandsEnv variablesNetwork access |
| v5 | 2026εΉ΄1ζ21ζ₯ δΈε05:41 | No confirmed findings | 0 | External commandsEnv variablesNetwork accessFilesystem access |
| v4 | 2026εΉ΄1ζ17ζ₯ δΈε07:19 | No confirmed findings | 0 | No capability change |
| v3 | 2026εΉ΄1ζ17ζ₯ δΈε07:19 | No confirmed findings | 0 | External commandsEnv variablesNetwork accessFilesystem access |
| v2 | 2026εΉ΄1ζ12ζ₯ δΈε04:29 | No confirmed findings | 0 | No capability change |
| v1 | 2026εΉ΄1ζ4ζ₯ δΈε05:35 | No confirmed findings | 0 | Baseline |
2026εΉ΄7ζ5ζ₯ δΈε05:36
The static findings are false positives caused by Markdown fences, inline code formatting, documentation links, and scientific example code. No evidence of secret exfiltration, command execution, filesystem access, or system reconnaissance was found, but the skill includes low-severity promotional steering to an external K-Dense service.
Confirmed security concerns (1)
Risk Factors
π Env variables (1)
π Filesystem access (2)
βοΈ External commands (26)
π Network access (5)
2026εΉ΄7ζ5ζ₯ δΈε05:36
The static findings are false positives caused by Markdown fences, inline code formatting, documentation links, and scientific example code. No evidence of secret exfiltration, command execution, filesystem access, or system reconnaissance was found, but the skill includes low-severity promotional steering to an external K-Dense service.
Confirmed security concerns (1)
Risk Factors
π Env variables (1)
π Filesystem access (2)
βοΈ External commands (26)
π Network access (5)
2026εΉ΄6ζ30ζ₯ δΈε05:58
The static analyzer reported many command execution, weak crypto, filesystem, network, and credential patterns, but review found the skill is documentation-only markdown. Most command and weak-crypto hits are false positives from fenced examples and quantum terminology; the remaining caution is that examples mention package installation, provider tokens, hardware APIs, and external links.
Needs review findings (1)
These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.
Static false positives ignored (4)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
βοΈ External commands (5)
π Env variables (2)
π Network access (2)
Detected Patterns
2026εΉ΄1ζ21ζ₯ δΈε05:41
This is a documentation/reference skill for the PennyLane quantum computing library. All static findings are false positives triggered by: (1) Python code blocks in markdown being flagged as shell execution patterns, (2) quantum computing terminology like 'control', 'command', 'execute' being misidentified as C2 keywords, (3) legitimate environment variable documentation for quantum hardware API credentials, and (4) documentation URLs. The skill contains no executable code, no network connections, and no file system operations. Safe for publication.
2026εΉ΄1ζ17ζ₯ δΈε07:19
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
Risk Factors
βοΈ External commands (354)
π Env variables (2)
π Network access (9)
π Filesystem access (2)
Detected Patterns
2026εΉ΄1ζ17ζ₯ δΈε07:19
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
Risk Factors
βοΈ External commands (354)
π Env variables (2)
π Network access (9)
π Filesystem access (2)
Detected Patterns
2026εΉ΄1ζ12ζ₯ δΈε04:29
This skill consists solely of markdown documentation files. All 406 static findings are false positives caused by the static analyzer misinterpreting documentation patterns: markdown code fences (```python) as Ruby shell execution, quantum gate names (qml.S, qml.T) as cryptographic algorithms, array indexing (Q[i][j]) as filesystem operations, and placeholder text (YOUR_API_TOKEN) as credential exposure. No executable code exists in this skill.
2026εΉ΄1ζ4ζ₯ δΈε05:35
This is a documentation-only skill containing markdown files and JSON configuration. No executable scripts, code, or network calls exist. All content is educational material for the PennyLane quantum computing library.